mirror
/
go
mirror of https://github.com/golang/go.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[release-branch.go1.10-security] cmd/go/internal/get: use a strings.Replacer in expand 

This should be a no-op, but produces deterministic (and more correct)
behavior if we have accidentally failed to sanitize one of the inputs.

Change-Id: I1271d0ffd01a691ec8c84906c4e02d9e2be19c72
Reviewed-on: https://team-review.git.corp.google.com/c/372707
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
This commit is contained in:
Bryan C. Mills 2018-12-04 15:42:32 -05:00
parent 7ef6ee2c57
commit aaa5f47754
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/cmd/go/internal/get/vcs.go
View File

@ -970,10 +970,14 @@ func matchGoImport(imports []metaImport, importPath string) (metaImport, error)
// expand rewrites s to replace {k} with match[k] for each key k in match.
func expand(match map[string]string, s string) string {
// We want to replace each match exactly once, and the result of expansion
// must not depend on the iteration order through the map.
// A strings.Replacer has exactly the properties we're looking for.
oldNew := make([]string, 0, 2*len(match))
for k, v := range match {
s = strings.Replace(s, "{"+k+"}", v, -1)
oldNew = append(oldNew, "{"+k+"}", v)
}
return s
return strings.NewReplacer(oldNew...).Replace(s)
}
// vcsPaths defines the meaning of import paths referring to